PT-2018-4958 · Shoretel · Shoretel Mobility Client

David Coomber · Published 2018-07-13 · Updated 2019-10-09 · CVE-2016-6562

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ShoreTel Mobility Client app version 9.1.3.109

Description The issue is related to the failure of the ShoreTel Mobility Client app to properly validate SSL certificates provided by HTTPS connections. This could allow an attacker, in a position to perform a man-in-the-middle (MITM) attack, to obtain sensitive account information, such as login credentials.

Recommendations For version 9.1.3.109, consider disabling the use of HTTPS connections until a patch is available that properly validates SSL certificates. Restrict access to sensitive account information to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2016-6562

Affected Products

Shoretel Mobility Client

References · 5

• https://osv.dev/vulnerability/CVE-2016-6562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6562 · Security Note
• https://securityfocus.com/bid/95224 · Note
• https://kb.cert.org/vuls/id/475907 · Note
• https://info-sec.ca/advisories/ShoreTel-Mobility.html · Note